Pull up following revision(s) (requested by riastradh in ticket #1686):
sys/dev/spkr.c: revision 1.25 (patch) spkr(4): Avoid some overflow issues.
This commit is contained in:
parent
15dd5d12c9
commit
8aa6e81113
|
@ -1,4 +1,4 @@
|
|||
/* $NetBSD: spkr.c,v 1.17 2019/04/18 13:01:38 isaki Exp $ */
|
||||
/* $NetBSD: spkr.c,v 1.17.4.1 2023/08/01 13:02:55 martin Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1990 Eric S. Raymond (esr@snark.thyrsus.com)
|
||||
|
@ -43,7 +43,7 @@
|
|||
*/
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__KERNEL_RCSID(0, "$NetBSD: spkr.c,v 1.17 2019/04/18 13:01:38 isaki Exp $");
|
||||
__KERNEL_RCSID(0, "$NetBSD: spkr.c,v 1.17.4.1 2023/08/01 13:02:55 martin Exp $");
|
||||
|
||||
#if defined(_KERNEL_OPT)
|
||||
#include "wsmux.h"
|
||||
|
@ -173,6 +173,7 @@ playtone(struct spkr_softc *sc, int pitch, int val, int sustain)
|
|||
* snum / (val * sdenom));
|
||||
return;
|
||||
}
|
||||
KASSERTMSG(pitch < __arraycount(pitchtab), "pitch=%d", pitch);
|
||||
|
||||
int fac = sc->sc_whole * (FILLTIME - sc->sc_fill);
|
||||
int fval = FILLTIME * val;
|
||||
|
@ -198,6 +199,10 @@ playstring(struct spkr_softc *sc, const char *cp, size_t slen)
|
|||
|
||||
#define GETNUM(cp, v) \
|
||||
for (v = 0; slen > 0 && isdigit((unsigned char)cp[1]); ) { \
|
||||
if (v > INT_MAX/10 - (cp[1] - '0')) { \
|
||||
v = INT_MAX; \
|
||||
continue; \
|
||||
} \
|
||||
v = v * 10 + (*++cp - '0'); \
|
||||
slen--; \
|
||||
}
|
||||
|
@ -281,6 +286,8 @@ playstring(struct spkr_softc *sc, const char *cp, size_t slen)
|
|||
slen--;
|
||||
} else {
|
||||
GETNUM(cp, sc->sc_octave);
|
||||
KASSERTMSG(sc->sc_octave >= 0, "%d",
|
||||
sc->sc_octave);
|
||||
if (sc->sc_octave >= NOCTAVES)
|
||||
sc->sc_octave = DFLT_OCTAVE;
|
||||
sc->sc_octprefix = true;
|
||||
|
@ -301,6 +308,9 @@ playstring(struct spkr_softc *sc, const char *cp, size_t slen)
|
|||
|
||||
case 'N':
|
||||
GETNUM(cp, pitch);
|
||||
KASSERTMSG(pitch >= 0, "pitch=%d", pitch);
|
||||
if (pitch >= __arraycount(pitchtab))
|
||||
break;
|
||||
for (sustain = 0; slen > 0 && cp[1] == '.'; cp++) {
|
||||
slen--;
|
||||
sustain++;
|
||||
|
|
Loading…
Reference in New Issue